CI: pin family-dev-handbook reusable workflows by commit SHA instead of mutable @ci-v1 (5 adopted nightly findings)

[shojikumaru]

Why

Nightly review findings, adopted in the 2026-08-31 stocktake triage (caty-ai/alpha-nightshift-dev#40). Five independent reports across 3 reviewers × 3 nights (2026-08-23 → 08-26) — the strongest convergence in the security batch — all still open in the ledger.

All six caller workflows (test-lint, gitleaks, history-check, pr-size, review-labels, release-sync; 11 references total) invoke caty-ai/family-dev-handbook reusable workflows at the mutable tag @ci-v1, while first-party actions in the same repo are pinned to full commit SHAs (e.g. actions/checkout@de0fac2e...). Consequences:

• A retag of ci-v1 silently changes what every required merge gate runs, with no SHA-visible change in this repo — supply-chain and review-bypass boundary.
• release-sync.yml additionally grants contents: write to code resolved through that mutable ref (highest blast radius).
• The pinning policy is internally inconsistent: low-risk first-party actions get SHA pinning, the highest-blast-radius gates do not.
• CI evidence referenced from README badges is not reproducible/content-addressed.

Done when

• All references to caty-ai/family-dev-handbook reusable workflows in the six caller workflows are pinned to a full commit SHA (with the tracking tag kept in a comment, e.g. @<sha> # ci-v1), or an explicit accepted-posture decision (rationale + compensating control such as tag-protection in the handbook repo) is recorded in-repo — one of the two, decided by the owner
• release-sync.yml permissions are re-reviewed under the chosen posture; contents: write is either justified next to the pin or narrowed
• A documented update procedure exists for advancing the pinned SHA when the handbook rolls ci-v1 (so pinning does not rot)
• All six workflows still pass on a probe PR after the change

触るファイル / モジュール予測

• .github/workflows/test-lint.yml
• .github/workflows/gitleaks.yml
• .github/workflows/history-check.yml
• .github/workflows/pr-size.yml
• .github/workflows/review-labels.yml
• .github/workflows/release-sync.yml
• docs (pin-update procedure or accepted-posture record)

Note: if the SHA-pin posture is adopted family-wide, the policy decision itself belongs to caty-ai/family-dev-handbook; this issue covers the caller-side pins in this repo either way.

---

Findings: rv-security-codex-6780fb46b4f2-4444acdf, rv-dependency-grok-6780fb46b4f2-d80fef9e, rv-dependency-kimi-6780fb46b4f2-2dca4942, rv-dependency-grok-4221b8a1f10f-c735dbf1, rv-dependency-kimi-4221b8a1f10f-6aac41de (ledger: alpha-nightshift state/ledger/ledger.jsonl)

[shojikumaru]

WIP

• agent: alpha (session 29e8c072, Claude Code)
• date: 2026-09-01
• Files to touch:
  • .github/workflows/test-lint.yml
  • .github/workflows/gitleaks.yml
  • .github/workflows/history-check.yml
  • .github/workflows/pr-size.yml
  • .github/workflows/review-labels.yml
  • .github/workflows/release-sync.yml
  • docs/engineering.md
  • docs/engineering.ja.md
• Branch: fix/245-pin-ci-v1-sha

Posture decision (owner-approved direction): the issue title's SHA-pin option — owner selected this issue to proceed as titled (2026-09-01). Pin target = the commit ci-v1 currently peels to: 8430452c1a22943c805ba2a940a75960299cfb2f (tag object 79bd3f3 is annotated; uses: pins must use the peeled commit SHA). 6 mutable references (1 per caller workflow) confirmed by grep. Pin-update procedure goes to docs/engineering.md/.ja. High-risk area (required merge gates = pre-publication gate boundary) → 5 heterogeneous review seats; size M (no upstream design review).

[shojikumaru]

MERGED

• PR: ci: pin family-dev-handbook reusable workflows to ci-v1 peeled SHA (#245) #255 (merge commit 1eafa55, candidate c257fca = PR head at review completion)
• 完了記録: PR ci: pin family-dev-handbook reusable workflows to ci-v1 peeled SHA (#245) #255 本文（L1-7・Done when 4/4 PASS・宣言8ファイルと diff 照合一致）
• レビュー記録: ci: pin family-dev-handbook reusable workflows to ci-v1 peeled SHA (#245) #255 (comment) （異種5席・全席累積 GO・correlated-seats 例外適用明記）
• release: v0.23.7 — 履行済み: https://github.com/caty-ai/caty-agent-harness/releases/tag/v0.23.7 （annotated tag → release-sync run success・published 2026-09-01T02:21:31Z。この tag push が Done-when 4 の release-sync 実弾検証を兼ね、pin 済み SHA で6本すべての reusable workflow の実行成功が揃った）
• previous release: v0.23.6 — 履行済み確認: https://github.com/caty-ai/caty-agent-harness/releases/tag/v0.23.6
• follow-up: CI: repo-state.yml pins caty-ai/family-os reusable workflow at mutable tag @v0.13.1 (contents: write, secrets: inherit) with no accepted-posture record #256（repo-state.yml の可変参照・5席レビュー副産物）
• lock disposition: 本コメントをもって WIP 解除（branch merge 済み・worktree/branch は掃除済み）